There's one software, let's call it an anti-malware, that uses a heuristic to detect some types of attack. However there's a very simple to stay under its radar. Where may I report that kind of "exploit"? It does not require patching anything at runtime or any interaction with that software, so I don't see it really as a vulnerability, just something they've overlooked. Where would I report that? Does that qualify for CVE?